Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [encoding]

Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.

-1
votes
0answers
64 views

XOR SHA hash and Base64

What does it mean to XOR a SHA-256 hash (of an input string) with a Base64 value ? I am tackling a scenario wherein an input string and a base64 value is given and I need to produce an output string ...
-1
votes
0answers
21 views

What encoding could this be? [duplicate]

I am currently doing a CTF and got stuck with this. D'N:^>!Z54WVxg5St?s0N;Kn%HZj43Dfec@a={)yxqYotsrk1ongf,dibgf%]baZYX]\Uy<;WPtT6RKoONMFKDhHGF(DCBA@9]765:981UT4ts10)M',%Ij(!~%|B"yx>v^zyxwvo5srkpoh....
0
votes
0answers
13 views

Is there any identification for common encoding/encryption? [duplicate]

While pentesting (web application) I come across lots of tokens which might be simply encoded and not random, but I don't know any way to identity if they are encoded or random, how to find is there ...
5
votes
1answer
135 views

Do ciphers and encoding schemes make passwords more secure?

I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
-2
votes
1answer
76 views

how to decode this request [closed]

I need help for this. I got a request but I don't know what can I do: GET http://localhost/xor.php?plaintext=cipher=%00%00%1D%10%1A,%06%05%16%16%0D%12%0B%3A9%5DRT%06YVD HTTP/1.1 Full request : https:...
1
vote
0answers
77 views

Problem with Reverse Engineering GVM light, possibly encoding issue

So I bought this GVM-560AS LED photography light on Amazon. It is a really good light for the job; but to control it remotely you have to download a really dodgy APK from the GVM website, a package ...
0
votes
3answers
132 views

What string encoding options are there besides xor? [closed]

When attempting to obfuscate strings in a modern program, xor is probably the most common option. By this I mean running each char of a string through a function which xors the char with some given ...
1
vote
0answers
47 views

rar and zip password encoding scheme [closed]

What encoding scheme is used in last versions of ZIP archives(6.3.2+) and RAR archives(3.90+), including RAR5? UTF-8/16, ASCII or something else?
-1
votes
1answer
119 views

What's the purpose of Base64 if knowing its Base64 makes it easy to decode

The title I think gets the point across. Lets focus solely on these hypothetical situations: Basic Auth headers when making API calls with user:pass Storing passwords in an SQL database What makes ...
1
vote
0answers
44 views

What exactly is URL-safe Base 64 encoding? [closed]

And how is it different form the normal Base 64 encoding?
1
vote
1answer
61 views

Encoding ASCII character as three-byte UTF-8. How does it work?

I'm reading a report on HackerOne https://hackerone.com/reports/52042. An input filter was bypassed by sending %E5%98%8A that was then parsed as 0x0A character (new line). The %E5%98%8A sequence ...
1
vote
0answers
55 views

Help needed in identifying a string [closed]

I need help in identifying the following string in order to decode it to a piece of meaningful information. h_t_s_/_g_s_._k_l_b_c_m_4_9_a_k_6_f_8_4_8_e_e_r_9_3_9_f_
3
votes
3answers
499 views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
2
votes
3answers
115 views

Is it risky to URL-encode characters in an already URL-encoded string?

I'm maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At ...
0
votes
2answers
136 views

is encoding the same as encryption for malware obfuscation?

I have been learning about hiding and executing msfvenom created shellcode and came to a technique where we xor the shellcode and when executing we reverse it.Would it be the same if i just encrypt it ...
0
votes
3answers
349 views

Why doesn't XSS execute when bypassing HTML encoding?

I am trying to execute an XSS payload on a search field that takes my input like this: <input name="q" id="gsasearch" type="text" value="My Input"></input> Observations: <, > and "...
1
vote
0answers
125 views

Help figuring out this hash function [closed]

I have a tough nut to crack. I'm working on hashing passwords for our network switches (because the alternative is plain-text passwords...). For people who would care about this; it's a huawei switch. ...
0
votes
1answer
109 views

Odd characters — including a backslash — in magstripe track 1 name field?

I've been in the Point of Sale industry for decades. Parsing card magnetic stripe track 1 data has never been difficult, but lately we've started to see some odd data in the name field of cards that ...
0
votes
1answer
36 views

Problem identifying this encoding schematic into plain text [duplicate]

Im really new to all of this i'd like some insight. the encoding scheme looks like this e0b7 e51f a24f 2ee8 f950 ecc4 d46b 6b3b 11bd 1930 ccb0 3c9f ecf5 368d f570 c72d a37e 47a6 bf03 2cf4 947c e913 ...
0
votes
2answers
4k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
3
votes
2answers
502 views

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context? I have a website that displays the URL path directly in HTML context, i.e....
3
votes
1answer
123 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
0
votes
1answer
183 views

Is a substring of base64 encoded random_bytes less secure then just using random_bytes

$bytes = random_bytes(15); $encoded = base64_encode($bytes); $output = substr($encoded, 0, 15); Does this code affect the complexity of the output vs just using $output = random_bytes(15); I think ...
1
vote
1answer
438 views

ASN.1 encoding of X25519 private key

I'm using mbed TLS for ECDH key agreement using Curve25519. The private and public keys are stored and transmitted as Hex strings as easily generated with mbed TLS. Those strings are big-endian. This ...
0
votes
1answer
52 views

SQL Query Sanatization

It seems to me SQL injection could be avoided by just converting everything to a simple encoding like base64 that doesn't have any harmful symbols. In the classic query "SELECT * FROM users WHERE ...
1
vote
0answers
63 views

Server improperly handling unicode characters?

So I'm pen-testing a web application. Upon submitting certain data it sends it in a POST request which contains the data in a JSON object. So while fuzzing it I was testing for improper encoding ...
4
votes
1answer
337 views

Hydra - Attacking when login page encodes the username and password

I needed to test how Hydra works, so I tried to attack my own wifi router. I set the user name as "user" and created a txt file containing 100 passwords including the "real" password. I am unable to ...
2
votes
0answers
361 views

Security risks with pdf files in object tag at client/server side

This is my situation: a user uploads a pdf file to my server. The data travels encoded in base64 (like a regular input in a form). The base64 is saved in one particular file on my server. Now, another ...
23
votes
1answer
4k views

When and why does bypassing XSS sanitizers with double encoding work?

I have read in different sites about different ways to bypass XSS sanitizers, like double encoding special characters such as /<>:"', or employing different encoding schemes. However most of ...
0
votes
2answers
603 views

Is it safe to get html encoded data from database to prevent stored XSS attack?

for security purpose now i'm fetching all data from database with htmlEncoded format. it is correct? please help..
1
vote
0answers
89 views

Exploiting XSS when attack vector is passed in Javascript context after being HTML encoded?

My attack vector is being passed in three contexts. HTML element: <p>injection</p> HTML attribute value: <input value="injection"> Javascript: <script> var a = "...
0
votes
0answers
841 views

Should Content-Encoding deflate be disabled [duplicate]

After scaning web page with Nikto I have results that is "The Content-Encoding header is set to "deflate" this may mean that the server is vulnerable to the BREACH attack." How to verify if that ...
4
votes
1answer
655 views

Why context sensitive encoding to prevent XSS?

OWASP recommends that context-sensitive encoding needs to be done. Please help me in getting a couple of strong "code examples" on why context sensitive based encoding needs to be done and why HTML ...
8
votes
3answers
2k views

How is character encodings used to bypass XSS sanitizers?

I read in different blogs that PHP htmlspecialchars() function has certain problems when one does not give the expected charset as an optional parameter. Can someone explain some basic stuff about ...
2
votes
1answer
78 views

Decoding requests from potentially malicious Android app

I have recently been doing some security evaluation work on our Android applications, by proxying all the communication through Burp Suite. I noticed one of our devices was sending requests to a ...
2
votes
1answer
116 views

Does the ECDSA signature value (of an OCSP response) need to be DER encoded

In OCSP responses by a certain eIDAS PKI I every once in a while get signature values which, when unpacked from their BIT STRING, contain an ECDSA signature whose INTEGER constituents have an ...
0
votes
1answer
301 views

Is it possible to “encode” a bash sentence?

I was recently solving a CTF challenge that I found quite strange, first of all I have been given a chain of characters that no matter how hard I try to find an answer I can not find it, I am going to ...
0
votes
2answers
206 views

Would using a QWERTY keyboard with DVORAK output cause keylogger to log DVORAK?

I have QWERT keyboard, but I have set the keyboard settings in Windows to DVORAK. So if I type "test" it comes out as "y.oy". Would the key logger log "test" or "y.oy" in its records?
2
votes
1answer
733 views

AngularJS Sanitize function vs. server-side output encoding

I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
4
votes
1answer
3k views

Bypassing browsers URL encoding to do reflected XSS from query parameter?

I tried to get reflected XSS in vulnerable website with a request to the following URL: https://vulnerable.website/dir/dir?param1=test"><svg/onload=alert(1)> The browser URL encode the ...
2
votes
3answers
129 views

What are some potential attacks that could be done to a website that doesn't manage url-encoding properly?

A month or so ago I was in the middle of one of my "Distributed Applications" classes and the professor was explaining us how to """properly""" authenticate users in a server. To demonstrate how to ...
2
votes
1answer
258 views

Phishing email with encoded url params

I received a phishing email with the following format: hxxp://<%legitimateSite%>/~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%...
0
votes
2answers
222 views

padding problem in sha-1 hashed password

For my own understanding of Websphere LTPA keys, I'm running this Java code, which works correctly when using the author's Base64 encoded, SHA1 hashed password: String ltpa3DESKey = "...
0
votes
1answer
675 views

Explanation of illegal multi-byte encoding leading to XSS

I'm reading this report on unicode security and found the following paragraphs confusing: When converting from a multi-byte encoding, a byte value may not be a valid trailing byte, in a context ...
0
votes
1answer
173 views

What type of encoded text is this and how can I translate it? [duplicate]

I have no experience, but I've been playing a game and it's rather interesting. One of the character files has a long line of scrambled text and I was wondering if someone could tell me if it's ...
1
vote
0answers
97 views

Are JSON key names vulnerable to alternate encoding (CAPEC-267) attacks?

It's sometimes possible to use an alternate encoding to get around security checks (CAPEC-267). While the JSON spec may be strict on what is valid, popular parsers don't necessarily conform perfectly [...
1
vote
1answer
790 views

Does storing Base64 encoding of scrypt password hash make it more vulnerable?

Scrypt produces a binary hash of a password. Instead of storing it as bytes directly, we are considering to store the Base64 encoding of this string. Would that make the password hash more vulnerable ...
1
vote
0answers
445 views

prevent CRLF Injection using encoding

I read in a lot of articles including this and this one that we should always use a function to encode the CR and LF special characters to prevent CRLF Injection, but AFAIK to perform this attack ...
2
votes
2answers
250 views

why is it insecure to use userdata in url parameter names?

On the OWASP site on XSS it says that it is safe to put userdata in GET parameter values when encoded. However, userdata should not be used anywhere else, so not in the scheme, the domain or ...
0
votes
1answer
247 views

Mov byte to addres inside a register

I am trying to write a shell insertion decoder (my encoder works as expected). But when I try to move one byte to the address inside a register i face a Segmentation fault. The error happens in this ...